|  | 8.5 | Server Administration
| 8.5.3 | Network control
A login account identifies the network user to the network system. This account along with the user's password identifies and gives access to the network system's resources. This account ID also holds the user responsible for his/her actions on the network. This should be stated in the security documents identified earlier in the chapter. Just because the network user has an account, does not mean the network resources are completely available to this user. Their user rights determine the user's resource availability. User rights are set by an administrator to permit or deny access to particular resource on a network. For example, even though a user is connected to the network and a network printer is also connected the network, the user may not be able to print to that printer. If the user is not assigned the right or permission to use the printer, access to that resource will be denied. If the user is assigned the right or permission, then the printer will be available. This is true of printers, data and program files, and any other "resources" on the network. There is one administrative problem with assigning rights to users. This is, if there are a lot of users on a network system, assigning and modifying rights for each individual user can take most of the administrator's time. This problem is resolved by the use of Groups. Groups are a logical grouping of users on the network. The way that groups work are that the rights and permissions are given to the group, instead of to an individual user. Then if a user needs these rights, they are assigned to the groups and by this action are given the rights assigned to the group. This is also true if the rights to a resource need to be changed, a change to the group will reflect that change to all of the group's members. This doesn't mean that rights can't be assigned to individual users. But the more efficient way in large networks is to work with groups. The terms, policy and profiles have to do not with system resources, but how the user interacts with the workstation. Profiles will allow a user to customize their user interface on a computer and then be able to use that profile at any computer they connect to the network with. This is called a Roaming Profile. Another type of profile will bring up the same user interface for everyone and not allow changes to be made. This is called a Mandatory Profile, and is used in situations where many people have to use the same physical computer. If the user is on the same computer all the time and does not need to go to other computers, they may have a Local Profile. A Local Profile is stored not on the network like the first two profiles, but on the local computer. Policies deal with the control of the resources on the local computer. A policy that prevents a user for storing data on the workstation's local hard or floppy drive can improve security by preventing data from being taken out of the building. Policies can also prevent users from accidentally making changes to their system configuration information. Things like video card settings, hard disk configuration, and network card settings, are aspects of the workstation that the majority of users have no need to change and if it is done can cause a lot of extra unnecessary work for help desk and network personnel. All of the aspects that we have just discussed can be summarized this way. Network rights, login accounts, passwords, and groups, along with profiles and policies provide a way for the system administrator to control access and restrictions to network services and control the local user workstation. Being a network administrator is also a set of rights and privileges granted on the network. Not all users have the right to change other users rights and privileges, these rights a reserved for certain groups that have been given administrator rights. By being part of a group that has administrator rights you also are an administrator.